EIEIOTECHNOVATION
← Training programmes

EIEIO / CYBERSECURITY

Defending Web Applications Security Essentials

Course outline

5 days
Discuss this programme →

Duration

5 days

Overview

This course is intended for anyone tasked with implementing, managing, or protecting Web applications. It is particularly well suited to application security analysts, developers, application architects, pen testers, auditors who are interested in recommending proper mitigations for web security issues, and infrastructure security professionals who have an interest in better defending their web applications.

Course Objectives

  • How to comprehensively remediate common web application vulnerabilities.
  • How to apply defensive application design and coding practices to avoid security vulnerabilities.
  • The HTTP protocol and new technologies such as SPDY and Websockets that affect the protocol stack.
  • How to move away from basic web application security principles of "validating more" and implement effective security controls against vulnerabilities that input validation simply does not fix.
  • How to customize, implement, and maintain a baseline security standard for the web applications development lifecycle (SANS SWAT checklist), improving security and reducing exposure to common vulnerabilities such as the OWASP Top 10 Risks.
  • How to leverage HTTP header-level protection to apply strong defense systems on the client side by building another layer of defense on top of secure coding on the server side.
  • How to design better and stronger security architecture that includes infrastructure aspects in the design process.
  • How to understand cutting-edge web technologies (such as HTML5) and their security implications, avoiding security issues when utilizing these newer technologies.

Prerequisite

This course requires a basic understanding of web application technology and concepts such as HTML and JavaScript.

Audience

  • Application developers
  • Application security analysts or managers
  • Application architects
  • Penetration testers who are interested in learning about defensive strategies
  • Security professionals who are interested in learning about web application security
  • Auditors who need to understand defensive mechanisms in web applications
  • Employees of PCI compliant organizations who need to be trained to comply with PCI requirements

Course Contents

  • 1. Web Basics and Authentication Security
  • HTTP basics
  • Overview of web technologies
  • Web application architecture
  • Recent attack trends
  • Authentication vulnerabilities and defense
  • Authorization vulnerabilities and defense
  • 2. Web Application Common Vulnerabilities and Mitigations
  • SSL vulnerabilities and testing
  • Proper encryption use in web application
  • Session vulnerabilities and testing
  • Cross-site request forgery
  • Business logic flaws
  • Concurrency
  • Input-related flaws and related defenses
  • SQL injection vulnerabilities, testing, and defense
  • 3. Proactive Defense and Operation Security
  • Cross-site scripting vulnerability and defenses
  • Web environment configuration security
  • Intrusion detection in web application
  • Incident handling
  • Honeytoken
  • 4. AJAX and Web Services Security
  • Web services overview
  • Security in parsing of XML
  • XML security
  • AJAX technologies overview
  • AJAX attack trends and common attacks
  • AJAX defense
  • 5. Cutting-Edge Web Security
  • Clickjacking
  • DNS rebinding
  • Flash security
  • Java applet security
  • Single-sign-on solution and security
  • IPv6 impact on web security
  • 6. Capture and Defend the Flag Exercise
  • Mitigation of server configuration errors
  • Discovering and mitigating coding problems
  • Testing business logic issues and fixing problems
  • Web services testing and security problem mitigation
  • Reinforcement through exercises of key topics discussed throughout the course.

Programme scope, delivery arrangements and suitability are confirmed during enquiry.